CVE-2026-43265

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-43265", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-05-01T14:12:55.997Z", "datePublished": "2026-05-06T11:28:51.552Z", "dateUpdated": "2026-11-06T15:42:45.276Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-11T22:21:13.005Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86: Ignore -EBUSY when checking nested events from vcpu_block()\n\nIgnore -EBUSY when checking nested events after exiting a blocking state\nwhile L2 is active, as exiting to userspace will generate a spurious\nuserspace exit, usually with KVM_EXIT_UNKNOWN, and likely lead to the VM's\ndemise. Continuing with the wakeup isn't perfect either, as *something*\nhas gone sideways if a vCPU is awakened in L2 with an injected event (or\nworse, a nested run pending), but continuing on gives the VM a decent\nchance of surviving without any major side effects.\n\nAs explained in the Fixes commits, it _should_ be impossible for a vCPU to\nbe put into a blocking state with an already-injected event (exception,\nIRQ, or NMI). Unfortunately, userspace can stuff MP_STATE and/or injected\nevents, and thus put the vCPU into what should be an impossible state.\n\nDon't bother trying to preserve the WARN, e.g. with an anti-syzkaller\nKconfig, as WARNs can (hopefully) be added in paths where _KVM_ would be\nviolating x86 architecture, e.g. by WARNing if KVM attempts to inject an\nexception or interrupt while the vCPU isn't running."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/x86/kvm/x86.c"], "versions": [{"version": "26844fee6adee9b1557d2279b0506285de9ee82b", "lessThan": "78265cd066d73a5cb41c088fcae4a2515e480d97", "status": "affected", "versionType": "git"}, {"version": "26844fee6adee9b1557d2279b0506285de9ee82b", "lessThan": "ec3be7dc9391085a2d96700e159d66d1328b7ff6", "status": "affected", "versionType": "git"}, {"version": "26844fee6adee9b1557d2279b0506285de9ee82b", "lessThan": "2657439265d34a911886b916ba8be97ecc117d51", "status": "affected", "versionType": "git"}, {"version": "26844fee6adee9b1557d2279b0506285de9ee82b", "lessThan": "1e88b5f854bdb469424132e0bb44793ad7a7c20a", "status": "affected", "versionType": "git"}, {"version": "26844fee6adee9b1557d2279b0506285de9ee82b", "lessThan": "1c957773063ed3264953597e32990a748381caf6", "status": "affected", "versionType": "git"}, {"version": "26844fee6adee9b1557d2279b0506285de9ee82b", "lessThan": "ead63640d4e72e6f6d464f4e31f7fecb79af8869", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/x86/kvm/x86.c"], "versions": [{"version": "6.1", "status": "affected"}, {"version": "0", "lessThan": "6.1", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.167", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.130", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.77", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.17", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.6", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1", "versionEndExcluding": "6.1.167"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1", "versionEndExcluding": "6.6.130"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1", "versionEndExcluding": "6.12.77"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1", "versionEndExcluding": "6.18.17"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1", "versionEndExcluding": "6.19.6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1", "versionEndExcluding": "7.0"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/78265cd066d73a5cb41c088fcae4a2515e480d97"}, {"url": "https://git.kernel.org/stable/c/ec3be7dc9391085a2d96700e159d66d1328b7ff6"}, {"url": "https://git.kernel.org/stable/c/2657439265d34a911886b916ba8be97ecc117d51"}, {"url": "https://git.kernel.org/stable/c/1e88b5f854bdb469424132e0bb44793ad7a7c20a"}, {"url": "https://git.kernel.org/stable/c/1c957773063ed3264953597e32990a748381caf6"}, {"url": "https://git.kernel.org/stable/c/ead63640d4e72e6f6d464f4e31f7fecb79af8869"}], "title": "KVM: x86: Ignore -EBUSY when checking nested events from vcpu_block()", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-43265", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-06T15:32:33.106636Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-06T15:42:45.276Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-43265", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-06T15:32:33.106636Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-06T15:32:34.574Z"}}], "cna": {"title": "KVM: x86: Ignore -EBUSY when checking nested events from vcpu_block()", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "26844fee6adee9b1557d2279b0506285de9ee82b", "lessThan": "78265cd066d73a5cb41c088fcae4a2515e480d97", "versionType": "git"}, {"status": "affected", "version": "26844fee6adee9b1557d2279b0506285de9ee82b", "lessThan": "ec3be7dc9391085a2d96700e159d66d1328b7ff6", "versionType": "git"}, {"status": "affected", "version": "26844fee6adee9b1557d2279b0506285de9ee82b", "lessThan": "2657439265d34a911886b916ba8be97ecc117d51", "versionType": "git"}, {"status": "affected", "version": "26844fee6adee9b1557d2279b0506285de9ee82b", "lessThan": "1e88b5f854bdb469424132e0bb44793ad7a7c20a", "versionType": "git"}, {"status": "affected", "version": "26844fee6adee9b1557d2279b0506285de9ee82b", "lessThan": "1c957773063ed3264953597e32990a748381caf6", "versionType": "git"}, {"status": "affected", "version": "26844fee6adee9b1557d2279b0506285de9ee82b", "lessThan": "ead63640d4e72e6f6d464f4e31f7fecb79af8869", "versionType": "git"}], "programFiles": ["arch/x86/kvm/x86.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.1"}, {"status": "unaffected", "version": "0", "lessThan": "6.1", "versionType": "semver"}, {"status": "unaffected", "version": "6.1.167", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.130", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.77", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.17", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "6.19.6", "versionType": "semver", "lessThanOrEqual": "6.19.*"}, {"status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["arch/x86/kvm/x86.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/78265cd066d73a5cb41c088fcae4a2515e480d97"}, {"url": "https://git.kernel.org/stable/c/ec3be7dc9391085a2d96700e159d66d1328b7ff6"}, {"url": "https://git.kernel.org/stable/c/2657439265d34a911886b916ba8be97ecc117d51"}, {"url": "https://git.kernel.org/stable/c/1e88b5f854bdb469424132e0bb44793ad7a7c20a"}, {"url": "https://git.kernel.org/stable/c/1c957773063ed3264953597e32990a748381caf6"}, {"url": "https://git.kernel.org/stable/c/ead63640d4e72e6f6d464f4e31f7fecb79af8869"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86: Ignore -EBUSY when checking nested events from vcpu_block()\n\nIgnore -EBUSY when checking nested events after exiting a blocking state\nwhile L2 is active, as exiting to userspace will generate a spurious\nuserspace exit, usually with KVM_EXIT_UNKNOWN, and likely lead to the VM's\ndemise. Continuing with the wakeup isn't perfect either, as *something*\nhas gone sideways if a vCPU is awakened in L2 with an injected event (or\nworse, a nested run pending), but continuing on gives the VM a decent\nchance of surviving without any major side effects.\n\nAs explained in the Fixes commits, it _should_ be impossible for a vCPU to\nbe put into a blocking state with an already-injected event (exception,\nIRQ, or NMI). Unfortunately, userspace can stuff MP_STATE and/or injected\nevents, and thus put the vCPU into what should be an impossible state.\n\nDon't bother trying to preserve the WARN, e.g. with an anti-syzkaller\nKconfig, as WARNs can (hopefully) be added in paths where _KVM_ would be\nviolating x86 architecture, e.g. by WARNing if KVM attempts to inject an\nexception or interrupt while the vCPU isn't running."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.167", "versionStartIncluding": "6.1"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.130", "versionStartIncluding": "6.1"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.77", "versionStartIncluding": "6.1"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.17", "versionStartIncluding": "6.1"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.19.6", "versionStartIncluding": "6.1"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.0", "versionStartIncluding": "6.1"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-11T22:21:13.005Z"}}}, "cveMetadata": {"cveId": "CVE-2026-43265", "state": "PUBLISHED", "dateUpdated": "2026-11-06T15:42:45.276Z", "dateReserved": "2026-05-01T14:12:55.997Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-05-06T11:28:51.552Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["arch/x86/kvm/x86.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "78265cd066d73a5cb41c088fcae4a2515e480d97", "status": "affected", "version": "26844fee6adee9b1557d2279b0506285de9ee82b", "versionType": "git"}, {"lessThan": "ec3be7dc9391085a2d96700e159d66d1328b7ff6", "status": "affected", "version": "26844fee6adee9b1557d2279b0506285de9ee82b", "versionType": "git"}, {"lessThan": "2657439265d34a911886b916ba8be97ecc117d51", "status": "affected", "version": "26844fee6adee9b1557d2279b0506285de9ee82b", "versionType": "git"}, {"lessThan": "1e88b5f854bdb469424132e0bb44793ad7a7c20a", "status": "affected", "version": "26844fee6adee9b1557d2279b0506285de9ee82b", "versionType": "git"}, {"lessThan": "1c957773063ed3264953597e32990a748381caf6", "status": "affected", "version": "26844fee6adee9b1557d2279b0506285de9ee82b", "versionType": "git"}, {"lessThan": "ead63640d4e72e6f6d464f4e31f7fecb79af8869", "status": "affected", "version": "26844fee6adee9b1557d2279b0506285de9ee82b", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["arch/x86/kvm/x86.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.1"}, {"lessThan": "6.1", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.167", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.130", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.77", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.17", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.6", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "C54AECAF-D924-45D0-89E2-77D4D1CC2E8E", "versionEndExcluding": "6.1.167", "versionStartIncluding": "6.1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "C57BB918-DF28-46B3-94F7-144176841267", "versionEndExcluding": "6.6.130", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "B3D12E00-E42D-4056-B354-BAD4903C03A5", "versionEndExcluding": "6.12.77", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "A5E006E4-59C7-43C1-9231-62A72219F2BA", "versionEndExcluding": "6.18.17", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67", "versionEndExcluding": "6.19.6", "versionStartIncluding": "6.19", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86: Ignore -EBUSY when checking nested events from vcpu_block()\n\nIgnore -EBUSY when checking nested events after exiting a blocking state\nwhile L2 is active, as exiting to userspace will generate a spurious\nuserspace exit, usually with KVM_EXIT_UNKNOWN, and likely lead to the VM's\ndemise. Continuing with the wakeup isn't perfect either, as *something*\nhas gone sideways if a vCPU is awakened in L2 with an injected event (or\nworse, a nested run pending), but continuing on gives the VM a decent\nchance of surviving without any major side effects.\n\nAs explained in the Fixes commits, it _should_ be impossible for a vCPU to\nbe put into a blocking state with an already-injected event (exception,\nIRQ, or NMI). Unfortunately, userspace can stuff MP_STATE and/or injected\nevents, and thus put the vCPU into what should be an impossible state.\n\nDon't bother trying to preserve the WARN, e.g. with an anti-syzkaller\nKconfig, as WARNs can (hopefully) be added in paths where _KVM_ would be\nviolating x86 architecture, e.g. by WARNing if KVM attempts to inject an\nexception or interrupt while the vCPU isn't running."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nKVM: x86: Ignorar -EBUSY al verificar eventos anidados desde vcpu_block()\n\nIgnorar -EBUSY al verificar eventos anidados despu\u00e9s de salir de un estado de bloqueo mientras L2 est\u00e1 activo, ya que salir al espacio de usuario generar\u00e1 una salida espuria del espacio de usuario, usualmente con KVM_EXIT_UNKNOWN, y probablemente llevar\u00e1 a la desaparici\u00f3n de la VM. Continuar con la activaci\u00f3n tampoco es perfecto, ya que algo ha salido mal si una vCPU es despertada en L2 con un evento inyectado (o peor, una ejecuci\u00f3n anidada pendiente), pero continuar le da a la VM una buena oportunidad de sobrevivir sin efectos secundarios importantes.\n\nComo se explica en los commits de Fixes, _deber\u00eda_ ser imposible que una vCPU sea puesta en un estado de bloqueo con un evento ya inyectado (excepci\u00f3n, IRQ o NMI). Desafortunadamente, el espacio de usuario puede introducir MP_STATE y/o eventos inyectados, y as\u00ed poner la vCPU en lo que deber\u00eda ser un estado imposible.\n\nNo te molestes en intentar preservar el WARN, p. ej., con un Kconfig anti-syzkaller, ya que los WARN pueden (con suerte) ser a\u00f1adidos en rutas donde _KVM_ estar\u00eda violando la arquitectura x86, p. ej., advirtiendo si KVM intenta inyectar una excepci\u00f3n o interrupci\u00f3n mientras la vCPU no est\u00e1 en ejecuci\u00f3n."}], "id": "CVE-2026-43265", "lastModified": "2026-11-11T23:10:00.263", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-43265", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-06T15:32:33.106636Z", "version": "2.0.3"}}]}, "published": "2026-05-06T12:16:47.510", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/1c957773063ed3264953597e32990a748381caf6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/1e88b5f854bdb469424132e0bb44793ad7a7c20a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/2657439265d34a911886b916ba8be97ecc117d51"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/78265cd066d73a5cb41c088fcae4a2515e480d97"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ead63640d4e72e6f6d464f4e31f7fecb79af8869"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ec3be7dc9391085a2d96700e159d66d1328b7ff6"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: KVM: x86: Ignore -EBUSY when checking nested events from vcpu_block()", "id": "2467124", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467124"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-1288", "details": ["A flaw was found in the Linux kernel's Kernel-based Virtual Machine (KVM) for x86 architectures. A local user or a malicious guest operating system could manipulate the virtual CPU (vCPU) state by injecting events while the vCPU is in a blocking state. This could lead to a spurious exit to userspace, potentially causing the virtual machine to crash, resulting in a Denial of Service (DoS)."], "name": "CVE-2026-43265", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-05-06T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-43265\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-43265\nhttps://lore.kernel.org/linux-cve-announce/2026050608-CVE-2026-43265-cf0a@gregkh/T"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[26844fee6adee9b1557d2279b0506285de9ee82b,78265cd066d73a5cb41c088fcae4a2515e480d97)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[26844fee6adee9b1557d2279b0506285de9ee82b,ec3be7dc9391085a2d96700e159d66d1328b7ff6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[26844fee6adee9b1557d2279b0506285de9ee82b,2657439265d34a911886b916ba8be97ecc117d51)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[26844fee6adee9b1557d2279b0506285de9ee82b,1e88b5f854bdb469424132e0bb44793ad7a7c20a)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[26844fee6adee9b1557d2279b0506285de9ee82b,1c957773063ed3264953597e32990a748381caf6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[26844fee6adee9b1557d2279b0506285de9ee82b,ead63640d4e72e6f6d464f4e31f7fecb79af8869)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "6.1"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.1)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.167,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.130,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.77,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.17,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19.6,6.20.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.0,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-05-06T15:15:09.165519+00:00", "updated": "2026-05-08T21:30:05.626154+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}